feat: typed credential rows + DPAPI key storage on Windows

Replace monolithic encrypted JSON credential blobs with individual typed
rows per (space, server, credential_type). Each token gets its own
lifecycle—access_token expiry is queryable without decryption, refresh
tokens persist independently, and only the secret value is encrypted.

Switch Windows key storage from Credential Manager (visible in UI) to
DPAPI file-based storage. Master key and JWT secret are stored as opaque
encrypted files in %LOCALAPPDATA%, not visible in any standard tool.
Includes one-time migration from Credential Manager on first launch.

Consolidate migrations 001-004 into single 001_initial.sql (pre-release).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

Author: its-mash

Cargo.lock

@@ -9,7 +9,6 @@ use mcpmux_gateway::{
     ConnectionContext, ConnectionResult, FeatureService, InstalledServerInfo, PoolService,
     ResolvedTransport, ServerKey,
 };
-use mcpmux_storage::{JwtSecretProvider, KeychainJwtSecretProvider};
 use serde::Serialize;
 use std::sync::Arc;
 use tauri::{AppHandle, Emitter, State};
@@ -466,11 +465,11 @@ fn create_gateway_dependencies(
     app_state: &AppState,
     _app_handle: tauri::AppHandle,
 ) -> Result<mcpmux_gateway::GatewayDependencies, String> {
-    // Load JWT signing secret from keychain (or create if first run)
-    let jwt_secret = match KeychainJwtSecretProvider::new() {
+    // Load JWT signing secret (DPAPI on Windows, keychain elsewhere)
+    let jwt_secret = match mcpmux_storage::create_jwt_secret_provider(app_state.data_dir()) {
         Ok(provider) => match provider.get_or_create_secret() {
             Ok(secret) => {
-                info!("[Gateway] JWT signing secret loaded from keychain");
+                info!("[Gateway] JWT signing secret loaded");
                 Some(secret)
             }
             Err(e) => {
@@ -479,7 +478,7 @@ fn create_gateway_dependencies(
             }
         },
         Err(e) => {
-            warn!("[Gateway] Failed to create keychain provider: {}", e);
+            warn!("[Gateway] Failed to create JWT secret provider: {}", e);
             None
         }
     };
@@ -1021,11 +1020,15 @@ pub async fn connect_all_enabled_servers(
                 }
             };
 
-            // Check if has OAuth credentials
+            // Check if has OAuth credentials (access token)
             let has_credentials = matches!(
                 app_state
                     .credential_repository
-                    .get(&space.id, &installed.server_id)
+                    .get(
+                        &space.id,
+                        &installed.server_id,
+                        &mcpmux_core::CredentialType::AccessToken
+                    )
                     .await,
                 Ok(Some(_))
             );

apps/desktop/src-tauri/src/commands/gateway.rs

@@ -478,18 +478,18 @@ pub async fn logout_server(
         .oauth_manager()
         .cancel_flow_for_space(space_uuid, &server_id);
 
-    // 3. Clear OAuth tokens from credential repository
+    // 3. Clear all credentials for this server
     if let Err(e) = app_state
         .credential_repository
-        .delete(&space_uuid, &server_id)
+        .delete_all(&space_uuid, &server_id)
         .await
     {
         warn!(
             "[ServerManager] Failed to delete credentials for {}: {}",
             server_id, e
         );
     } else {
-        info!("[ServerManager] Cleared OAuth tokens for {}", server_id);
+        info!("[ServerManager] Cleared credentials for {}", server_id);
     }
 
     // 4. Clear oauth_connected flag

apps/desktop/src-tauri/src/commands/server_manager.rs

@@ -300,12 +300,11 @@ pub fn run() {
                 let url = format!("http://localhost:{}", final_port);
                 info!("Auto-starting gateway on {}", url);
 
-                // Load JWT signing secret from keychain (or create if first run)
-                use mcpmux_storage::{JwtSecretProvider, KeychainJwtSecretProvider};
-                let jwt_secret = match KeychainJwtSecretProvider::new() {
+                // Load JWT signing secret (DPAPI on Windows, keychain elsewhere)
+                let jwt_secret = match mcpmux_storage::create_jwt_secret_provider(&app_data_dir) {
                     Ok(provider) => match provider.get_or_create_secret() {
                         Ok(secret) => {
-                            info!("[Gateway] JWT signing secret loaded from keychain");
+                            info!("[Gateway] JWT signing secret loaded");
                             Some(secret)
                         }
                         Err(e) => {
@@ -314,7 +313,7 @@ pub fn run() {
                         }
                     },
                     Err(e) => {
-                        warn!("[Gateway] Failed to create keychain provider: {}. Token signing disabled.", e);
+                        warn!("[Gateway] Failed to create JWT secret provider: {}. Token signing disabled.", e);
                         None
                     }
                 };

apps/desktop/src-tauri/src/lib.rs

@@ -11,10 +11,9 @@ use mcpmux_core::{
     SpaceService,
 };
 use mcpmux_storage::{
-    Database, FieldEncryptor, KeychainKeyProvider, MasterKeyProvider, SqliteAppSettingsRepository,
-    SqliteCredentialRepository, SqliteFeatureSetRepository, SqliteInboundMcpClientRepository,
-    SqliteInstalledServerRepository, SqliteOutboundOAuthRepository, SqliteServerFeatureRepository,
-    SqliteSpaceRepository,
+    Database, FieldEncryptor, SqliteAppSettingsRepository, SqliteCredentialRepository,
+    SqliteFeatureSetRepository, SqliteInboundMcpClientRepository, SqliteInstalledServerRepository,
+    SqliteOutboundOAuthRepository, SqliteServerFeatureRepository, SqliteSpaceRepository,
 };
 use std::path::PathBuf;
 use std::sync::Arc;
@@ -67,9 +66,9 @@ impl AppState {
         // Ensure data directory exists
         std::fs::create_dir_all(&data_dir)?;
 
-        // Get or create master key from OS keychain
-        info!("Retrieving master key from keychain...");
-        let key_provider = KeychainKeyProvider::new()?;
+        // Get or create master key (DPAPI on Windows, OS Keychain elsewhere)
+        info!("Retrieving master key...");
+        let key_provider = mcpmux_storage::create_key_provider(&data_dir)?;
         let master_key = key_provider.get_or_create_key()?;
         info!("Master key retrieved successfully");
 
@@ -87,8 +86,9 @@ impl AppState {
         let space_repository: Arc<dyn SpaceRepository> =
             Arc::new(SqliteSpaceRepository::new(db.clone()));
 
-        let installed_server_repository: Arc<dyn InstalledServerRepository> =
-            Arc::new(SqliteInstalledServerRepository::new(db.clone()));
+        let installed_server_repository: Arc<dyn InstalledServerRepository> = Arc::new(
+            SqliteInstalledServerRepository::new(db.clone(), encryptor.clone()),
+        );
 
         let credential_repository: Arc<dyn CredentialRepository> = Arc::new(
             SqliteCredentialRepository::new(db.clone(), encryptor.clone()),

apps/desktop/src-tauri/src/state/mod.rs

@@ -175,9 +175,9 @@ impl ServerAppService {
             }
         }
 
-        // Delete credentials
+        // Delete all credentials for this server
         if let Some(ref cred_repo) = self.credential_repo {
-            if let Err(e) = cred_repo.delete(&space_id, server_id).await {
+            if let Err(e) = cred_repo.delete_all(&space_id, server_id).await {
                 warn!(
                     server_id = server_id,
                     error = %e,